M45: authenticate Prometheus scraping

2026-08-21 18:33:23 +02:00
parent acd8b82b09
commit ec02aca0fd
4 changed files with 22 additions and 5 deletions
@@ -2,12 +2,17 @@ services:
  prometheus:
    image: prom/prometheus:v3.7.1@sha256:ff7e389acbe064a4823212a500393d40a28a8f362e4b05cbf6742a9a3ef736b2
    profiles: ["observability"]
+    entrypoint: ["/bin/sh", "-ec"]
    command:
-      - --config.file=/etc/prometheus/prometheus.yml
-      - --storage.tsdb.retention.time=30d
-      - --web.enable-lifecycle
+      - >-
+        sed "s|__METRICS_BEARER_TOKEN__|$${METRICS_BEARER_TOKEN}|g"
+        /etc/prometheus/template.yml > /tmp/prometheus.yml
+        && exec /bin/prometheus --config.file=/tmp/prometheus.yml
+        --storage.tsdb.retention.time=30d --web.enable-lifecycle
+    environment:
+      METRICS_BEARER_TOKEN: ${METRICS_BEARER_TOKEN:?Set the private metrics bearer token}
    volumes:
-      - ./deploy/observability/prometheus.yml:/etc/prometheus/prometheus.yml:ro
+      - ./deploy/observability/prometheus.yml:/etc/prometheus/template.yml:ro
      - ./deploy/observability/alerts.yml:/etc/prometheus/alerts.yml:ro
      - mobilityops-prometheus:/prometheus
    ports: